Warning: Permanently added '10.128.1.98' (ED25519) to the list of known hosts.
2026/02/13 03:53:26 parsed 1 programs
[ 72.943200][ T5825] cgroup: Unknown subsys name 'net'
[ 73.031473][ T5825] cgroup: Unknown subsys name 'cpuset'
[ 73.040159][ T5825] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 74.463134][ T5825] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 77.397649][ T5841] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 79.926707][ T5898] chnl_net:caif_netlink_parms(): no params data found
[ 80.029429][ T5898] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.037414][ T5898] bridge0: port 1(bridge_slave_0) entered disabled state
[ 80.044900][ T5898] bridge_slave_0: entered allmulticast mode
[ 80.053555][ T5898] bridge_slave_0: entered promiscuous mode
[ 80.070201][ T5898] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.077380][ T5898] bridge0: port 2(bridge_slave_1) entered disabled state
[ 80.084690][ T5898] bridge_slave_1: entered allmulticast mode
[ 80.092405][ T5898] bridge_slave_1: entered promiscuous mode
[ 80.123022][ T5898] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 80.140125][ T5898] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 80.173786][ T5898] team0: Port device team_slave_0 added
[ 80.183267][ T5898] team0: Port device team_slave_1 added
[ 80.217786][ T5898] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 80.224797][ T5898] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.250787][ T5898] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 80.264886][ T5898] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 80.272170][ T5898] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.298508][ T5898] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 80.343070][ T5898] hsr_slave_0: entered promiscuous mode
[ 80.349886][ T5898] hsr_slave_1: entered promiscuous mode
[ 80.495283][ T5898] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 80.507718][ T5898] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 80.518613][ T5898] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 80.528894][ T5898] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 80.558797][ T5898] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.566018][ T5898] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 80.574220][ T5898] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.581395][ T5898] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 80.648951][ T5898] 8021q: adding VLAN 0 to HW filter on device bond0
[ 80.674583][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 80.682837][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 80.694826][ T5898] 8021q: adding VLAN 0 to HW filter on device team0
[ 80.711837][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 80.719015][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 80.734148][ T174] bridge0: port 2(bridge_slave_1) entered blocking state
[ 80.741315][ T174] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 80.914380][ T5898] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 80.973161][ T5898] veth0_vlan: entered promiscuous mode
[ 80.985917][ T5898] veth1_vlan: entered promiscuous mode
[ 81.026045][ T5898] veth0_macvtap: entered promiscuous mode
[ 81.037648][ T5898] veth1_macvtap: entered promiscuous mode
[ 81.061556][ T5898] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 81.078015][ T5898] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 81.095761][ T174] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.105174][ T174] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.116607][ T174] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.126937][ T174] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 81.246400][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.259804][ T5923] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 81.267536][ T5923] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 81.280166][ T5923] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 81.289438][ T5923] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 81.297008][ T5923] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 81.354526][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.429444][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.549962][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 81.623479][ T174] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 81.631951][ T174] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 81.675448][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 81.684891][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/02/13 03:53:38 executed programs: 0
[ 82.267009][ T5923] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 82.277602][ T5923] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 82.286740][ T5923] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 82.297115][ T5923] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 82.305129][ T5923] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 82.439703][ T5938] chnl_net:caif_netlink_parms(): no params data found
[ 82.518048][ T5938] bridge0: port 1(bridge_slave_0) entered blocking state
[ 82.525531][ T5938] bridge0: port 1(bridge_slave_0) entered disabled state
[ 82.532943][ T5938] bridge_slave_0: entered allmulticast mode
[ 82.540427][ T5938] bridge_slave_0: entered promiscuous mode
[ 82.550997][ T5938] bridge0: port 2(bridge_slave_1) entered blocking state
[ 82.558938][ T5938] bridge0: port 2(bridge_slave_1) entered disabled state
[ 82.566130][ T5938] bridge_slave_1: entered allmulticast mode
[ 82.573837][ T5938] bridge_slave_1: entered promiscuous mode
[ 82.608514][ T5938] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 82.622176][ T5938] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 82.660554][ T5938] team0: Port device team_slave_0 added
[ 82.670072][ T5938] team0: Port device team_slave_1 added
[ 82.699544][ T5938] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 82.706584][ T5938] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 82.733004][ T5938] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 82.745948][ T5938] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 82.753037][ T5938] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 82.779875][ T5938] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 82.834742][ T5938] hsr_slave_0: entered promiscuous mode
[ 82.842136][ T5938] hsr_slave_1: entered promiscuous mode
[ 82.849752][ T5938] debugfs: 'hsr0' already exists in 'hsr'
[ 82.855588][ T5938] Cannot create hsr debugfs directory
[ 84.138321][ T12] bridge_slave_1: left allmulticast mode
[ 84.144136][ T12] bridge_slave_1: left promiscuous mode
[ 84.151859][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 84.163474][ T12] bridge_slave_0: left allmulticast mode
[ 84.170487][ T12] bridge_slave_0: left promiscuous mode
[ 84.176242][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.337435][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 84.348678][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 84.359581][ T12] bond0 (unregistering): Released all slaves
[ 84.382187][ T5923] Bluetooth: hci0: command tx timeout
[ 84.445008][ T12] hsr_slave_0: left promiscuous mode
[ 84.452737][ T12] hsr_slave_1: left promiscuous mode
[ 84.459479][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 84.466915][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 84.477721][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 84.485279][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 84.500578][ T12] veth1_macvtap: left promiscuous mode
[ 84.507146][ T12] veth0_macvtap: left promiscuous mode
[ 84.513269][ T12] veth1_vlan: left promiscuous mode
[ 84.518823][ T12] veth0_vlan: left promiscuous mode
[ 84.813892][ T12] team0 (unregistering): Port device team_slave_1 removed
[ 84.837391][ T12] team0 (unregistering): Port device team_slave_0 removed
[ 85.326239][ T5938] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 85.342770][ T5938] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 85.354873][ T5938] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 85.366936][ T5938] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 85.665759][ T5938] 8021q: adding VLAN 0 to HW filter on device bond0
[ 85.737934][ T5938] 8021q: adding VLAN 0 to HW filter on device team0
[ 85.756701][ T58] bridge0: port 1(bridge_slave_0) entered blocking state
[ 85.764033][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 85.789146][ T235] bridge0: port 2(bridge_slave_1) entered blocking state
[ 85.796410][ T235] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 86.129505][ T5938] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 86.221724][ T5938] veth0_vlan: entered promiscuous mode
[ 86.242870][ T5938] veth1_vlan: entered promiscuous mode
[ 86.292556][ T5938] veth0_macvtap: entered promiscuous mode
[ 86.314657][ T5938] veth1_macvtap: entered promiscuous mode
[ 86.352252][ T5938] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 86.371426][ T5938] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 86.395405][ T235] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 86.417504][ T235] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 86.427136][ T235] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 86.440230][ T235] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 86.449174][ T5923] Bluetooth: hci0: command tx timeout
[ 86.540848][ T174] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 86.554801][ T174] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 86.595255][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 86.605538][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 86.668471][ T5923] ==================================================================
[ 86.676577][ T5923] BUG: KASAN: stack-out-of-bounds in l2cap_send_cmd+0x2a3/0xb90
[ 86.684228][ T5923] Read of size 22 at addr ffffc90003357540 by task kworker/u9:2/5923
[ 86.692301][ T5923]
[ 86.694662][ T5923] CPU: 1 UID: 0 PID: 5923 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 86.694686][ T5923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[ 86.694699][ T5923] Workqueue: hci0 hci_rx_work
[ 86.694732][ T5923] Call Trace:
[ 86.694740][ T5923]
[ 86.694750][ T5923] dump_stack_lvl+0xe8/0x150
[ 86.694777][ T5923] print_report+0xba/0x230
[ 86.694800][ T5923] ? l2cap_send_cmd+0x2a3/0xb90
[ 86.694818][ T5923] kasan_report+0x117/0x150
[ 86.694836][ T5923] ? trace_kmem_cache_alloc+0x29/0xf0
[ 86.694861][ T5923] ? l2cap_send_cmd+0x2a3/0xb90
[ 86.694883][ T5923] kasan_check_range+0x264/0x2c0
[ 86.694901][ T5923] ? l2cap_send_cmd+0x2a3/0xb90
[ 86.694921][ T5923] __asan_memcpy+0x29/0x70
[ 86.694944][ T5923] l2cap_send_cmd+0x2a3/0xb90
[ 86.694966][ T5923] l2cap_recv_frame+0xd352/0x10110
[ 86.694989][ T5923] ? lock_release+0x4b/0x3d0
[ 86.695009][ T5923] ? ret_from_fork_asm+0x1a/0x30
[ 86.695033][ T5923] ? unwind_next_frame+0xa5/0x23c0
[ 86.695056][ T5923] ? rcu_is_watching+0x15/0xb0
[ 86.695079][ T5923] ? lock_release+0x4b/0x3d0
[ 86.695098][ T5923] ? unwind_next_frame+0x1aaf/0x23c0
[ 86.695124][ T5923] ? unwind_next_frame+0xa5/0x23c0
[ 86.695146][ T5923] ? unwind_next_frame+0x1aaf/0x23c0
[ 86.695173][ T5923] ? __pfx_l2cap_recv_frame+0x10/0x10
[ 86.695194][ T5923] ? ret_from_fork_asm+0x1a/0x30
[ 86.695217][ T5923] ? ret_from_fork_asm+0x1a/0x30
[ 86.695241][ T5923] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 86.695262][ T5923] ? ret_from_fork_asm+0x1a/0x30
[ 86.695287][ T5923] ? stack_trace_save+0xa9/0x100
[ 86.695304][ T5923] ? __pfx_stack_trace_save+0x10/0x10
[ 86.695322][ T5923] ? check_path+0x21/0x40
[ 86.695344][ T5923] ? check_noncircular+0xda/0x150
[ 86.695454][ T5923] ? add_lock_to_list+0xc7/0x100
[ 86.695478][ T5923] ? lockdep_unlock+0x5d/0xd0
[ 86.695495][ T5923] ? __lock_acquire+0x146e/0x2cf0
[ 86.695524][ T5923] ? __mutex_trylock_common+0x158/0x260
[ 86.695551][ T5923] ? __pfx___mutex_trylock_common+0x10/0x10
[ 86.695576][ T5923] ? rcu_is_watching+0x15/0xb0
[ 86.695598][ T5923] ? trace_contention_end+0x3d/0x150
[ 86.695622][ T5923] ? __mutex_lock+0x319/0x1300
[ 86.695645][ T5923] ? l2cap_recv_acldata+0x2e3/0x13e0
[ 86.695668][ T5923] ? l2cap_recv_acldata+0x30b/0x13e0
[ 86.695690][ T5923] ? __mutex_unlock_slowpath+0x1bd/0x7d0
[ 86.695711][ T5923] ? __pfx___mutex_lock+0x10/0x10
[ 86.695730][ T5923] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 86.695749][ T5923] ? l2cap_conn_hold_unless_zero+0x179/0x2b0
[ 86.695772][ T5923] ? __pfx_l2cap_conn_hold_unless_zero+0x10/0x10
[ 86.695798][ T5923] ? l2cap_recv_acldata+0x41/0x13e0
[ 86.695821][ T5923] l2cap_recv_acldata+0x7e9/0x13e0
[ 86.695846][ T5923] hci_rx_work+0x4f9/0x1040
[ 86.695869][ T5923] ? process_one_work+0x87c/0x1650
[ 86.695888][ T5923] process_one_work+0x949/0x1650
[ 86.695917][ T5923] ? __pfx_process_one_work+0x10/0x10
[ 86.695935][ T5923] ? do_raw_spin_lock+0x12b/0x2f0
[ 86.695958][ T5923] worker_thread+0xb46/0x1140
[ 86.695982][ T5923] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.696003][ T5923] kthread+0x388/0x470
[ 86.696017][ T5923] ? __pfx_worker_thread+0x10/0x10
[ 86.696037][ T5923] ? __pfx_kthread+0x10/0x10
[ 86.696052][ T5923] ret_from_fork+0x51e/0xb90
[ 86.696075][ T5923] ? __pfx_ret_from_fork+0x10/0x10
[ 86.696094][ T5923] ? __switch_to+0xc7d/0x1450
[ 86.696113][ T5923] ? __pfx_kthread+0x10/0x10
[ 86.696130][ T5923] ret_from_fork_asm+0x1a/0x30
[ 86.696160][ T5923]
[ 86.696166][ T5923]
[ 87.033056][ T5923] The buggy address belongs to stack of task kworker/u9:2/5923
[ 87.040581][ T5923] and is located at offset 128 in frame:
[ 87.046280][ T5923] l2cap_recv_frame+0x0/0x10110
[ 87.051129][ T5923]
[ 87.053441][ T5923] This frame has 26 objects:
[ 87.058011][ T5923] [32, 34) 'rsp.i238.i.i'
[ 87.058023][ T5923] [48, 88) 'chan.i.i.i'
[ 87.062419][ T5923] [128, 146) 'pdu_u.i.i.i'
[ 87.066645][ T5923] [192, 202) 'rsp.i94.i.i'
[ 87.071133][ T5923] [224, 226) 'rsp.i.i.i111'
[ 87.075706][ T5923] [240, 242) 'rej.i'
[ 87.080278][ T5923] [256, 258) 'rej.i145.i'
[ 87.084240][ T5923] [272, 274) 'rej.i143.i'
[ 87.088722][ T5923] [288, 290) 'req.i229.i.i'
[ 87.093126][ T5923] [304, 312) 'buf.i222.i.i'
[ 87.097698][ T5923] [336, 348) 'buf29.i.i.i'
[ 87.102284][ T5923] [368, 372) 'rsp49.i.i.i'
[ 87.106767][ T5923] [384, 393) 'rfc.i.i118.i.i'
[ 87.111251][ T5923] [416, 480) 'buf.i119.i.i'
[ 87.115994][ T5923] [512, 576) 'req.i120.i.i'
[ 87.120563][ T5923] [608, 617) 'rfc.i.i.i.i'
[ 87.125133][ T5923] [640, 656) 'efs.i.i.i.i'
[ 87.129615][ T5923] [672, 678) 'rej.i371.i.i.i'
[ 87.134105][ T5923] [704, 710) 'rej.i.i.i.i'
[ 87.138858][ T5923] [736, 800) 'rsp.i.i.i'
[ 87.143339][ T5923] [832, 896) 'buf.i.i.i'
[ 87.147650][ T5923] [928, 1056) 'req.i.i.i'
[ 87.151964][ T5923] [1088, 1096) 'rsp.i.i.i.i'
[ 87.156424][ T5923] [1120, 1122) 'info.i.i.i.i'
[ 87.161081][ T5923] [1136, 1264) 'buf.i.i.i.i'
[ 87.165827][ T5923] [1296, 1298) 'rej.i.i'
[ 87.170490][ T5923]
[ 87.177099][ T5923] The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90003350000 allocated at copy_process+0x508/0x3cf0
[ 87.190037][ T5923] The buggy address belongs to the physical page:
[ 87.196446][ T5923] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36e0f
[ 87.205199][ T5923] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 87.212319][ T5923] raw: 00fff00000000000 0000000000000000 ffffea0000db83c8 0000000000000000
[ 87.220885][ T5923] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 87.229447][ T5923] page dumped because: kasan: bad access detected
[ 87.235849][ T5923] page_owner tracks the page as allocated
[ 87.241544][ T5923] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 174, tgid 174 (kworker/u8:6), ts 80851768066, free_ts 75368874415
[ 87.260986][ T5923] post_alloc_hook+0x231/0x280
[ 87.265752][ T5923] get_page_from_freelist+0x24dc/0x2580
[ 87.271291][ T5923] __alloc_frozen_pages_noprof+0x18d/0x380
[ 87.277097][ T5923] alloc_pages_mpol+0x232/0x4a0
[ 87.281940][ T5923] alloc_pages_noprof+0xa8/0x190
[ 87.286860][ T5923] __vmalloc_node_range_noprof+0x79b/0x1730
[ 87.292742][ T5923] __vmalloc_node_noprof+0xc2/0x100
[ 87.297933][ T5923] dup_task_struct+0x228/0x9a0
[ 87.302683][ T5923] copy_process+0x508/0x3cf0
[ 87.307258][ T5923] kernel_clone+0x248/0x8e0
[ 87.311755][ T5923] user_mode_thread+0x110/0x180
[ 87.316689][ T5923] call_usermodehelper_exec_work+0x9c/0x230
[ 87.322572][ T5923] process_one_work+0x949/0x1650
[ 87.327505][ T5923] worker_thread+0xb46/0x1140
[ 87.332172][ T5923] kthread+0x388/0x470
[ 87.336243][ T5923] ret_from_fork+0x51e/0xb90
[ 87.340820][ T5923] page last free pid 5825 tgid 5825 stack trace:
[ 87.347131][ T5923] __free_frozen_pages+0xc2b/0xdb0
[ 87.352233][ T5923] __folio_put+0x414/0x4f0
[ 87.356643][ T5923] skb_release_data+0x4cb/0x940
[ 87.361480][ T5923] napi_consume_skb+0x1d8/0x290
[ 87.366344][ T5923] skb_defer_free_flush+0x191/0x260
[ 87.371531][ T5923] net_rx_action+0x455/0xf70
[ 87.376113][ T5923] handle_softirqs+0x22a/0x870
[ 87.380868][ T5923] do_softirq+0x76/0xd0
[ 87.385013][ T5923] __local_bh_enable_ip+0xf8/0x130
[ 87.390112][ T5923] __dev_queue_xmit+0x1e6c/0x38a0
[ 87.395123][ T5923] ip_finish_output2+0xc68/0x1070
[ 87.400132][ T5923] ip_output+0x29f/0x450
[ 87.404357][ T5923] __ip_queue_xmit+0x1198/0x1be0
[ 87.409276][ T5923] __tcp_transmit_skb+0x2b30/0x43e0
[ 87.414456][ T5923] tcp_write_xmit+0x16e8/0x6980
[ 87.419296][ T5923] tcp_sendmsg_locked+0x2dc9/0x5490
[ 87.424532][ T5923]
[ 87.426847][ T5923] Memory state around the buggy address:
[ 87.432465][ T5923] ffffc90003357400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 87.440516][ T5923] ffffc90003357480: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f2 f8 f8
[ 87.448597][ T5923] >ffffc90003357500: f8 f8 f8 f2 f2 f2 f2 f2 00 00 02 f2 f2 f2 f2 f2
[ 87.456647][ T5923] ^
[ 87.463301][ T5923] ffffc90003357580: f8 f8 f2 f2 f8 f2 f8 f2 f8 f2 f8 f2 f8 f2 f8 f2
[ 87.471347][ T5923] ffffc90003357600: f2 f2 f8 f8 f2 f2 f8 f2 f8 f8 f2 f2 f8 f8 f8 f8
[ 87.479494][ T5923] ==================================================================
[ 87.496405][ T5923] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.503739][ T5923] CPU: 1 UID: 0 PID: 5923 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 87.513370][ T5923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[ 87.523417][ T5923] Workqueue: hci0 hci_rx_work
[ 87.528093][ T5923] Call Trace:
[ 87.531363][ T5923]
[ 87.534294][ T5923] vpanic+0x56c/0xa60
[ 87.538275][ T5923] ? __pfx_vpanic+0x10/0x10
[ 87.542774][ T5923] panic+0xc5/0xd0
[ 87.546575][ T5923] ? __pfx_panic+0x10/0x10
[ 87.550990][ T5923] ? preempt_schedule_thunk+0x16/0x30
[ 87.556531][ T5923] ? preempt_schedule_thunk+0x16/0x30
[ 87.561894][ T5923] ? l2cap_send_cmd+0x2a3/0xb90
[ 87.566739][ T5923] check_panic_on_warn+0x89/0xb0
[ 87.571668][ T5923] ? l2cap_send_cmd+0x2a3/0xb90
[ 87.576520][ T5923] end_report+0x73/0x180
[ 87.580757][ T5923] ? l2cap_send_cmd+0x2a3/0xb90
[ 87.585602][ T5923] kasan_report+0x128/0x150
[ 87.590092][ T5923] ? trace_kmem_cache_alloc+0x29/0xf0
[ 87.595458][ T5923] ? l2cap_send_cmd+0x2a3/0xb90
[ 87.600302][ T5923] kasan_check_range+0x264/0x2c0
[ 87.605276][ T5923] ? l2cap_send_cmd+0x2a3/0xb90
[ 87.610114][ T5923] __asan_memcpy+0x29/0x70
[ 87.614533][ T5923] l2cap_send_cmd+0x2a3/0xb90
[ 87.619202][ T5923] l2cap_recv_frame+0xd352/0x10110
[ 87.624312][ T5923] ? lock_release+0x4b/0x3d0
[ 87.628889][ T5923] ? ret_from_fork_asm+0x1a/0x30
[ 87.633817][ T5923] ? unwind_next_frame+0xa5/0x23c0
[ 87.638921][ T5923] ? rcu_is_watching+0x15/0xb0
[ 87.643687][ T5923] ? lock_release+0x4b/0x3d0
[ 87.648267][ T5923] ? unwind_next_frame+0x1aaf/0x23c0
[ 87.653593][ T5923] ? unwind_next_frame+0xa5/0x23c0
[ 87.658695][ T5923] ? unwind_next_frame+0x1aaf/0x23c0
[ 87.663974][ T5923] ? __pfx_l2cap_recv_frame+0x10/0x10
[ 87.669344][ T5923] ? ret_from_fork_asm+0x1a/0x30
[ 87.674288][ T5923] ? ret_from_fork_asm+0x1a/0x30
[ 87.679325][ T5923] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 87.685477][ T5923] ? ret_from_fork_asm+0x1a/0x30
[ 87.690417][ T5923] ? stack_trace_save+0xa9/0x100
[ 87.695345][ T5923] ? __pfx_stack_trace_save+0x10/0x10
[ 87.700715][ T5923] ? check_path+0x21/0x40
[ 87.705037][ T5923] ? check_noncircular+0xda/0x150
[ 87.710069][ T5923] ? add_lock_to_list+0xc7/0x100
[ 87.715025][ T5923] ? lockdep_unlock+0x5d/0xd0
[ 87.719703][ T5923] ? __lock_acquire+0x146e/0x2cf0
[ 87.724730][ T5923] ? __mutex_trylock_common+0x158/0x260
[ 87.730278][ T5923] ? __pfx___mutex_trylock_common+0x10/0x10
[ 87.736180][ T5923] ? rcu_is_watching+0x15/0xb0
[ 87.741202][ T5923] ? trace_contention_end+0x3d/0x150
[ 87.746494][ T5923] ? __mutex_lock+0x319/0x1300
[ 87.751342][ T5923] ? l2cap_recv_acldata+0x2e3/0x13e0
[ 87.756629][ T5923] ? l2cap_recv_acldata+0x30b/0x13e0
[ 87.761903][ T5923] ? __mutex_unlock_slowpath+0x1bd/0x7d0
[ 87.767614][ T5923] ? __pfx___mutex_lock+0x10/0x10
[ 87.772636][ T5923] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 87.778711][ T5923] ? l2cap_conn_hold_unless_zero+0x179/0x2b0
[ 87.784700][ T5923] ? __pfx_l2cap_conn_hold_unless_zero+0x10/0x10
[ 87.791030][ T5923] ? l2cap_recv_acldata+0x41/0x13e0
[ 87.796225][ T5923] l2cap_recv_acldata+0x7e9/0x13e0
[ 87.801419][ T5923] hci_rx_work+0x4f9/0x1040
[ 87.805920][ T5923] ? process_one_work+0x87c/0x1650
[ 87.811023][ T5923] process_one_work+0x949/0x1650
[ 87.815959][ T5923] ? __pfx_process_one_work+0x10/0x10
[ 87.821330][ T5923] ? do_raw_spin_lock+0x12b/0x2f0
[ 87.826352][ T5923] worker_thread+0xb46/0x1140
[ 87.831028][ T5923] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 87.836837][ T5923] kthread+0x388/0x470
[ 87.840914][ T5923] ? __pfx_worker_thread+0x10/0x10
[ 87.846110][ T5923] ? __pfx_kthread+0x10/0x10
[ 87.850697][ T5923] ret_from_fork+0x51e/0xb90
[ 87.855293][ T5923] ? __pfx_ret_from_fork+0x10/0x10
[ 87.860396][ T5923] ? __switch_to+0xc7d/0x1450
[ 87.865068][ T5923] ? __pfx_kthread+0x10/0x10
[ 87.869647][ T5923] ret_from_fork_asm+0x1a/0x30
[ 87.874411][ T5923]
[ 87.877837][ T5923] Kernel Offset: disabled
[ 87.882256][ T5923] Rebooting in 86400 seconds..